first commit

tests/transfer-facts.test.mjs

@@ -0,0 +1,13 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import facts from '../packages/core/transfer-facts.cjs';
+import {toECS,toCEF} from '../packages/core/siem.mjs';
+test('security file facts carry exact bytes and detected type without arbitrary content',()=>{
+ const file=facts.transferFacts({bytes:123,detectedType:'pe',sha256:'a'.repeat(64)});
+ const e={id:1,time:new Date().toISOString(),kind:'download.block',metadata:{file}};
+ assert.equal(toECS(e).file.size,123);assert.equal(toECS(e).file.type,'pe');assert.match(toCEF(e),/cs6=pe/);
+ assert.throws(()=>facts.transferFacts({...file,password:'forbidden'}));
+ assert.throws(()=>facts.transferFacts({...file,bytes:-1}));
+ e.metadata.file={bytes:123,detectedType:'password=secret',sha256:'a'.repeat(64)};
+ assert.equal(toECS(e).file,undefined);assert.equal(toCEF(e).includes('password=secret'),false);
+});